CVE-2026-109942 in FreeRDP
Summary
by MITRE • 10/13/2026
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-byte CLOSE_CHANNEL header to crash a connecting FreeRDP client.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical failure in input validation and boundary checking within the Remote Desktop Protocol (RD) gateway processing logic. Specifically, the flaw resides in the rdg_process_close_packet function located in libfreerdp/core/gateway/rdg.c. This component is responsible for handling control packets associated with closing remote desktop sessions or channels. The root cause of this vulnerability is a logical error where the application accepts PKT_TYPE_CLOSE_CHANNEL messages that contain only an eight-byte header without any accompanying payload data. In normal operation, these packets are expected to carry specific metadata required to properly terminate connections and release resources. However, due to insufficient checks on packet length or structure, the software proceeds to dereference a NULL stream pointer when attempting to process this malformed input. This behavior indicates that the developer assumed the presence of valid payload data without verifying its existence first, leading directly to an invalid memory access condition.
From a technical perspective, this issue is classified under CWE-476, which denotes a NULL Pointer Dereference vulnerability. When the rdg_process_control_packet function receives a CLOSE_CHANNEL packet with no payload, it attempts to read from or write to a null pointer within the stream processing routine. This action triggers an immediate segmentation fault on most operating systems, resulting in the abrupt termination of the FreeRDP client process. The attack vector requires interaction with an RD Gateway server that is either maliciously configured by an attacker or compromised through other means. By sending specifically crafted eight-byte packets containing only the CLOSE_CHANNEL header type and length fields but omitting any actual channel closure data, an adversary can reliably trigger this crash condition against any connected FreeRDP client attempting to establish or maintain a session through that gateway.
The operational impact of this vulnerability is primarily denial of service for end-users relying on remote desktop connections via FreeRDP. While the immediate effect is a client-side application crash rather than arbitrary code execution, such instability can disrupt critical business operations and create opportunities for further exploitation if combined with other vulnerabilities in the stack or surrounding infrastructure. Furthermore, repeated crashes may lead to resource exhaustion as clients attempt to reconnect, potentially impacting network availability. This flaw aligns with ATT&CK technique T1499 Endpoint Denial of Service, where an adversary disrupts access to or availability of computing resources by consuming them through malicious actions such as sending malformed packets that cause application failures.
To mitigate this risk, organizations must ensure that all FreeRDP installations are updated to version 3.32.0 or later, where the developers have implemented proper validation checks for packet payloads before dereferencing stream pointers. In addition to software updates, network segmentation strategies should be employed to restrict access to RD Gateway servers from untrusted networks. Monitoring tools can also be configured to detect anomalous traffic patterns indicative of crafted packets being sent to gateway endpoints, providing an additional layer of defense-in-depth against potential exploitation attempts until patches are fully deployed across the environment.